3327 matches found
CVE-2024-34357 TYPO3 vulnerable to Cross-Site Scripting in ShowImageController
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the ShowImageController eID txcmsshowpic is vulnerable to cross-si...
CVE-2024-34357 TYPO3 vulnerable to Cross-Site Scripting in ShowImageController
TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the ShowImageController eID txcmsshowpic is vulnerable to cross-si...
CVE-2024-33002 Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS)
Document Service handler obsolete in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability with low impact on Confidentiality and Integrity of the application...
CVE-2024-33002 Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS)
Document Service handler obsolete in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability with low impact on Confidentiality and Integrity of the application...
Fortinet FortiVoice 安全漏洞
Fortinet FortiVoice is a network communications solution from Fortinet, Inc. A security vulnerability exists in Fortinet FortiVoice that originates from an authorization bypass via a user-controlled key vulnerability that allows an authenticated attacker to read another user's SIP configuration v...
TYPO3 9.0.0 < 9.5.48 ELTS / 10.0.0 < 10.4.45 ELTS / 11.0.0 < 11.5.37 / 12.0.0 < 12.4.15 / 13.0.0 < 13.1.1 XSS (TYPO3-CORE-SA-2024-009)
The version of TYPO3 installed on the remote host is prior to 9.0.0 9.5.48 ELTS / 10.0.0 10.4.45 ELTS / 11.0.0 11.5.37 / 12.0.0 12.4.15 / 13.0.0 13.1.1. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2024-009 advisory. - TYPO3 is an enterprise content management...
CVE-2024-34383
CVE-2024-34383 corresponds to an Authorization Bypass Through User-Controlled Key in SEOPress (WordPress plugin). Connected Red Hat and Red Hat-adjacent advisories corroborate the issue label and public description: an authorization bypass via a user-controlled key in SEOPress could affect SEOPre...
PT-2024-25843 · Seo Guys · Seopress
Name of the Vulnerable Software and Affected Versions: SEOPress versions 7.7.1 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability affects The SEO Guys at SEOPress SEOPress. Recommendations: For SEOPress versions...
CVE-2024-2346
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated...
CVE-2024-2346
CVE-2024-2346 affects the FileBird – WordPress Media Library Folders & File Manager plugin for WordPress. All versions up to and including 5.6.3 are vulnerable to Insecure Direct Object Reference via folder deletion due to missing validation on a user-controlled key. This allows authenticated att...
CVE-2024-4336
Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability via the /adive/admin/tables/add, in multiple parameters. An attacker could retrieve the session details of an authenticated user...
CVE-2024-4336 Múltiple vulnerabilities on Adive Framework
Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability via the /adive/admin/tables/add, in multiple parameters. An attacker could retrieve the session details of an authenticated user...
CVE-2024-4336
CVE-2024-4336 affects Adive Framework 2.0.8. The vulnerability is a persistent XSS due to insufficient encoding of user-controlled inputs, exploitable via the /adive/admin/tables/add endpoint across multiple parameters. The available documents indicate an attacker could retrieve the session detai...
CVE-2024-4337 Múltiple vulnerabilities on Adive Framework
Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability via the /adive/admin/nav/add, in multiple parameters. This vulnerability allows an attacker to retrieve the session details of an authenticated user...
CVE-2024-4337
CVE-2024-4337 affects Adive Framework 2.0.8. The root cause is insufficient encoding of user-controlled inputs, causing a persistent XSS vulnerability via the /adive/admin/nav/add endpoint across multiple parameters. This can enable an attacker to retrieve authenticated user session details. Publ...
CVE-2024-33542
Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5...
PHP 安全漏洞
PHP is a scripting language in which PHP is executed server-side. A security vulnerability exists in PHP that originates when using the procopen command with array syntax, due to insufficient escaping, which allows a user to supply parameters to execute arbitrary commands in the Windows shell if...
CVE-2024-25050
CVE-2024-25050 affects IBM i versions 7.2–7.5 and IBM Rational Development Studio for i versions 7.2–7.5. The root cause is an unqualified library call in the networking and compiler infrastructure, allowing a local user to execute user-controlled code with elevated (administrator) privileges. Im...